> For the complete documentation index, see [llms.txt](https://docs.stoik.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stoik.io/mdr/deploy/crowdstrike/os/virtual-environments.md). # Virtual environments Install the Falcon sensor on a golden image so that every cloned VM gets its own identity. The method depends on whether your VMs are **persistent** or **non-persistent**. ## Prerequisites * A **VMware vSphere + Citrix Cloud (DaaS) MCS** environment. For other hypervisors or provisioning technologies, refer to their respective documentation. For the full Citrix DaaS documentation, see [Citrix DaaS](https://docs.citrix.com/en-us/citrix-daas). * For non-persistent VMs, host machines that meet all three of the following criteria: * Are non-persistent * Are domain-joined * Use an FQDN that does not change ## VM types Before installing, identify which type of VDI environment you are working with: | Type | Description | | ----------------------- | ----------------------------------------------------------------------------------------- | | **Non-persistent** | VM does not retain changes after reboot. Rebuilt from master image on every login/reboot. | | **Persistent (Static)** | VM retains all changes after reboot. User always connects to the same machine. | {% hint style="warning" %} Using the wrong method may result in all cloned VMs sharing the same Agent ID (AID), causing detections from multiple machines to appear as coming from a single host. {% endhint %} ## Install the sensor {% stepper %} {% step %} ### Prepare the golden image The golden image (also called master image, base VM, or base image) must be properly configured before installing the Falcon sensor. The sensor must always be **the last software installed**. #### Operating system and network * Install Windows OS and apply all latest Windows Updates. * Configure network settings (DNS, Gateway) and open the necessary network traffic: see [Network requirements](/mdr/deploy/crowdstrike/network.md). * Join the machine to the Active Directory domain. * Verify the domain trust relationship: ```powershell Test-ComputerSecureChannel ``` Expected result: `True` {% hint style="info" %} Do not disable the **Windows Security Center** service. CrowdStrike requires it to be active. {% endhint %} #### Hypervisor tools Install the integration tools for your hypervisor (Citrix VM Tools, Hyper-V Integration Services, or VMware Tools) **before** installing the VDA and the Falcon sensor. #### Citrix Virtual Delivery Agent (VDA) The VDA must be installed on the master image before creating the Machine Catalog. 1. Download the VDA from `Citrix Cloud` > `Downloads` > `Virtual Delivery Agent for Windows Single-session OS`. 2. Run the installer as administrator. 3. On the `Environment` page, select `Create a master MCS image`. 4. On the `Delivery Controller` page, enter the FQDN of your Citrix Cloud Connector: `Citrix Cloud` > `Resource Locations` > select your location > `Cloud Connectors`. 5. Complete the installation and reboot. {% hint style="info" %} Do not run Sysprep on master images when using MCS. MCS handles generalization and unique identity assignment for each cloned VM. {% endhint %} {% endstep %} {% step %} ### Download the Falcon sensor installer 1. Log in to the Falcon Console. 2. Go to `Host Setup and Management` > `Deploy` > `Sensor Downloads`, or from Stoïk Protect: `MDR` > `Settings` > `Virtual environments` > `Download the executable`. 3. Copy your CCID (Customer ID Checksum) displayed on the same page. 4. Copy the installer onto the golden image. {% endstep %} {% step %} ### Send information to Stoïk Send the following information to : * The **naming convention** of your VDI machines (e.g. `SRV-VDA-*`, `VDA-USER-###`). * The **name of the golden image** used as the master image. This information is required to configure the host group and the sensor update policy on Stoïk's side. {% endstep %} {% step %} ### Install the sensor on the golden image {% tabs %} {% tab title="Non-persistent" %} #### Install Open `cmd` as administrator on the golden image and run: ```cmd WindowsSensor.exe /install CID= VDI=1 ``` #### Verify the service is running ```powershell Get-Service CSFalconService ``` Expected: `Status = Running` #### Leave the VM online (1 hour minimum) After installation, leave the golden image powered on long enough for: * The sensor to connect to the CrowdStrike cloud and update to the version defined in the assigned sensor update policy. * All necessary files to be downloaded. #### Shut down and take a snapshot 1. Shut down from within Windows (not from the hypervisor power off button). 2. Wait for the VM to reach **Powered Off** state in your hypervisor. 3. Take a snapshot of the powered-off VM: * Name: `CS-VDI-Clean-[date]` * Do not check `Snapshot the virtual machine's memory`. {% endtab %} {% tab title="Persistent" %} With `NO_START=1`, the sensor is installed without starting and without contacting the CrowdStrike cloud. The unique AID is assigned the first time each cloned VM boots. {% hint style="warning" %} After installing with `NO_START=1`, **never reboot** the golden image before shutting it down. A reboot triggers cloud communication and generates an AID that will be shared by all clones. {% endhint %} #### Install Open `cmd` as administrator on the golden image and run: ```cmd WindowsSensor.exe /install CID= NO_START=1 ``` #### Verify the service is stopped (expected behavior) ```powershell Get-Service CSFalconService ``` Expected: `Status = Stopped` The service will start automatically on the first boot of each cloned VM. #### Shut down and take a snapshot 1. Shut down from within Windows (not from the hypervisor power off button). 2. Wait for the VM to reach **Powered Off** state in your hypervisor. 3. Take a snapshot of the powered-off VM: * Name: `CS-Template-Clean-[date]` * Do not check `Snapshot the virtual machine's memory`. {% endtab %} {% endtabs %} {% endstep %} {% step %} ### Create the Machine Catalog in Citrix Cloud Web Studio Once the golden image snapshot is ready, create or update the Machine Catalog in Citrix Cloud Web Studio. Key settings to configure in the catalog creation wizard: | Page | Non-Persistent | Persistent | | ------------------ | --------------------------------------------- | -------------------------------------------------- | | Machine Type | Single-session OS | Single-session OS | | Machine Management | MCS | MCS | | Desktop Experience | **Random** | **Static** | | Image | Golden image + snapshot `CS-VDI-Clean-[date]` | Golden image + snapshot `CS-Template-Clean-[date]` | | {% endstep %} | | | | {% endstepper %} | | | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.stoik.io/mdr/deploy/crowdstrike/os/virtual-environments.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.